Aztec Connect exploit drains $2.1M from dormant contract

Attackers drained approximately $2.1 million from the deprecated Aztec Connect platform on Sunday by exploiting a vulnerability in the protocol's transaction verification mechanism.

Aztec Labs said it was investigating the incident after funds were transferred from the legacy Aztec Connect smart contract, adding that the exploit did not affect users or assets on the current Aztec Network.

Blockchain security firm BlockSec said the attacker exploited a mismatch between how transactions were verified through zero-knowledge proofs and how they were ultimately settled on Ethereum.

According to BlockSec, the flaw allowed the verification system and settlement logic to interpret transaction data differently, enabling the attacker to create balances that were not properly backed by assets.

The attacker repeated the exploit seven times across multiple cryptocurrencies, stealing 909 Ether, 270,000 Dai, 167 wrapped staked Ether and several other digital assets.

Aztec Connect launched in 2022 as a decentralised finance bridge before being deprecated in March 2023, when deposits were halted and development efforts shifted to the next-generation Aztec Network.

“Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us,”

The company said following the incident.

At the time of reporting, Ethereum price was $1,716.99.